The separation is enforced in the database, not in the interface. Every row of customer data carries its organisation, and the database applies row-level access rules so that a query only ever sees rows belonging to your own organisation.
This means the separation holds even if a fault were to occur in the application code ΓÇö the query cannot reach another organisation's rows, because the restriction sits beneath the application.
Which organisation you belong to is derived from your sign-in and cannot be influenced from the browser.